PT-2018-5061 · Processmaker · Processmaker Enterprise Core

Name of the Vulnerable Software and Affected Versions: ProcessMaker Enterprise Core version 3.0.1.7-community Description: A code execution issue exists due to unsafe deserialization. This can be triggered by a specially crafted web request, potentially resulting in PHP code being executed. An...

Intel OpenVINO Toolkit for Windows Privilege License and Access Control Issues Vulnerability

Intel OpenVINO Toolkit for Windows is a Windows-based toolkit for developing multi-platform computer vision solutions from Intel. Intel OpenVINO Toolkit for Windows is vulnerable to a privilege permission and access control issue. An attacker could exploit this vulnerability to execute code using...

MGASA-2018-0362 Updated quazip packages fix security vulnerability

Updated quazip packages fix security vulnerability: A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar,x...

UBUNTU-CVE-2018-15911

In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code...

SUSE-SU-2018:2403-1 Security update for mutt

This update for mutt fixes the following issues: Security issues fixed: - CVE-2018-14352: Fix imapquotestring in imap/util.c that does not leave room for quote characters bsc1101582. - CVE-2018-14353: Fix imapquotestring in imap/util.c that has an integer underflow bsc1101581. - CVE-2018-14362: F...

Foxit Reader Remote Code Execution Vulnerability (CNVD-2018-14454)

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

CVE-2017-2579

An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack function has an insufficient code value check, so that a maliciously crafted file could cause the application to crash or possibly allows code execution...

CVE-2017-2581

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution...

CVE-2017-2580

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution...

CVE-2016-9492

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PH...

jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the c3p0 gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS ...

CVE-2016-10620

atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

unicode code execution vulnerability

unicode is a tool that provides data from unicode for nodejs. A security vulnerability exists in unicode versions prior to 9.0.0, which originates from a program that insecurely downloads resources over the HTTP protocol. An attacker can exploit the vulnerability to alter or read resources and...

CVE-2018-9976

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-9950

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Foxit Reader ConvertToPDF_x86 jpg Parsing Out-of-Bounds Read Information Disclosure Vulnerability (CNVD-2018-09995)

Foxit Reader is a small PDF document viewer and printing program. Foxit Reader has a security vulnerability in ConvertToPDFx86.dll, which can be exploited by attackers to obtain sensitive information or even execute arbitrary code due to a lack of proper validation of user-supplied data...

Joruri Gw vulnerable to arbitrary file upload

Overview Joruri Gw provided by SiteBridge Inc. is groupware which runs on Ruby on Rails. Joruri Gw contains a vulnerability that may allow an attacker to upload arbitrary files CWE-434. Shoji Baba of Kobe Digital Labo, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

SUSE-SU-2018:0947-1 Security update for evince

This update for evince fixes the following issues: - CVE-2017-1000159: Command injection in evince via filename when printing to PDF could lead to command execution bsc1070046...

DEBIAN-CVE-2018-1000051

Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fzkeepkeystorable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF...

PT-2018-4910

Name of the Vulnerable Software and Affected Versions web2py versions prior to 2.14.2 Description The issue allows remote attackers to obtain the session cookie key value via a direct request to "examples/simple examples/status". This can be leveraged to execute arbitrary code. Recommendations Fo...